# Security Policy

## Supported versions

`pi-context-compiler` is an experimental research package. Security fixes are
provided for the latest `0.2.x` release only.

## 0.2.x verification boundaries

The passive `preflight` command first runs an unverified executable `--version`,
then sends four read-only RPC requests under an isolated HOME/temp/cwd/config
surface. Production acceptance is a strict ordered eight-record schema/shape with
fixed lifecycle and zero-activity fields and bounded audited variants—not a
single normalized byte-exact transcript. Exact normalized transcript matching is
reserved for the independent `smoke:pi` check. Hosts other than the audited
0.83.0 fail closed by design. The default binary may resolve package-local or
ambient PATH and is always unverified; the version is self-reported;
provider activity is not host-attested; runner constants such as `promptSent`
and the passive-request set are fixed by the runner, while `transcriptValid` and
activity observation are transcript-derived. H1–H10 proof is not performed, and
a pass remains status-only `NO_GO`.

The artifact verifier checks deterministic report schema/honesty, self-digest and
versioned semantic commitment, repeated recomputation through the same package
build, and packaged JSON/Markdown freshness. The semantic commitment is compiled
in-band in the same package/build; double recomputation means two calls through
that same build and detects deterministic artifact drift, but is not an external
trust root or independent reproduction. These hashes and commitments identify
checked bytes locally; they are not signatures, MACs, authenticity or provenance
attestations, truth checks, or empirical evidence.

## Reporting a vulnerability

Please use [GitHub private vulnerability reporting](https://github.com/ZhenHuangLab/pi-context-compiler/security/advisories/new). Do not include secrets, private source, credentials, or exploit details in a public issue.

Include the affected version, a minimal reproduction, impact, and any suggested mitigation. You should receive an acknowledgement within 7 days.

## Current security boundary

The Pi 0.83 extension is intentionally **capability-blocked** and exposes status surfaces only. It does not mediate live provider requests or claim that the Phase 0 harness is available. The bundled Phase -1 evaluator is fixture-only, performs zero live model calls, and must not be treated as empirical or product-readiness evidence.

If a host cannot provide the required fail-closed mediation, authenticated phase metadata, usage binding, checkpoint association, and provider-attested identity, the correct behavior is `NO_GO`—not emulation through background sessions, custom messages, widgets, or virtual providers.